All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
To: David Airlie <airlied@linux.ie>,
	Gerd Hoffmann <kraxel@redhat.com>,
	Gurchetan Singh <gurchetansingh@chromium.org>,
	Chia-I Wu <olvaffe@gmail.com>, Daniel Vetter <daniel@ffwll.ch>,
	Daniel Almeida <daniel.almeida@collabora.com>,
	Gert Wollny <gert.wollny@collabora.com>,
	Tomeu Vizoso <tomeu.vizoso@collabora.com>,
	Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
	Maxime Ripard <mripard@kernel.org>,
	Thomas Zimmermann <tzimmermann@suse.de>,
	Rob Herring <robh@kernel.org>,
	Steven Price <steven.price@arm.com>,
	Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>,
	Rob Clark <robdclark@gmail.com>
Cc: linux-kernel@vger.kernel.org,
	virtualization@lists.linux-foundation.org,
	Gustavo Padovan <gustavo.padovan@collabora.com>,
	dri-devel@lists.freedesktop.org,
	Dmitry Osipenko <dmitry.osipenko@collabora.com>,
	Dmitry Osipenko <digetx@gmail.com>
Subject: [PATCH v3 02/15] drm/virtio: Check whether transferred 2D BO is shmem
Date: Tue, 12 Apr 2022 00:59:24 +0300	[thread overview]
Message-ID: <20220411215937.281655-3-dmitry.osipenko@collabora.com> (raw)
In-Reply-To: <20220411215937.281655-1-dmitry.osipenko@collabora.com>

Transferred 2D BO always must be a shmem BO. Add check for that to prevent
NULL dereference if userspace passes a VRAM BO.

Cc: stable@vger.kernel.org
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
---
 drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 7c052efe8836..2edf31806b74 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -595,7 +595,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
 	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
 	struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo);
 
-	if (use_dma_api)
+	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
 					    shmem->pages, DMA_TO_DEVICE);
 
-- 
2.35.1


WARNING: multiple messages have this Message-ID (diff)
From: Dmitry Osipenko <dmitry.osipenko@collabora.com>
To: David Airlie <airlied@linux.ie>,
	Gerd Hoffmann <kraxel@redhat.com>,
	Gurchetan Singh <gurchetansingh@chromium.org>,
	Chia-I Wu <olvaffe@gmail.com>, Daniel Vetter <daniel@ffwll.ch>,
	Daniel Almeida <daniel.almeida@collabora.com>,
	Gert Wollny <gert.wollny@collabora.com>,
	Tomeu Vizoso <tomeu.vizoso@collabora.com>,
	Maarten Lankhorst <maarten.lankhorst@linux.intel.com>,
	Maxime Ripard <mripard@kernel.org>,
	Thomas Zimmermann <tzimmermann@suse.de>,
	Rob Herring <robh@kernel.org>,
	Steven Price <steven.price@arm.com>,
	Alyssa Rosenzweig <alyssa.rosenzweig@collabora.com>,
	Rob Clark <robdclark@gmail.com>
Cc: dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
	Gustavo Padovan <gustavo.padovan@collabora.com>,
	Daniel Stone <daniel@fooishbar.org>,
	virtualization@lists.linux-foundation.org,
	Dmitry Osipenko <digetx@gmail.com>,
	Dmitry Osipenko <dmitry.osipenko@collabora.com>
Subject: [PATCH v3 02/15] drm/virtio: Check whether transferred 2D BO is shmem
Date: Tue, 12 Apr 2022 00:59:24 +0300	[thread overview]
Message-ID: <20220411215937.281655-3-dmitry.osipenko@collabora.com> (raw)
In-Reply-To: <20220411215937.281655-1-dmitry.osipenko@collabora.com>

Transferred 2D BO always must be a shmem BO. Add check for that to prevent
NULL dereference if userspace passes a VRAM BO.

Cc: stable@vger.kernel.org
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
---
 drivers/gpu/drm/virtio/virtgpu_vq.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
index 7c052efe8836..2edf31806b74 100644
--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
+++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
@@ -595,7 +595,7 @@ void virtio_gpu_cmd_transfer_to_host_2d(struct virtio_gpu_device *vgdev,
 	bool use_dma_api = !virtio_has_dma_quirk(vgdev->vdev);
 	struct virtio_gpu_object_shmem *shmem = to_virtio_gpu_shmem(bo);
 
-	if (use_dma_api)
+	if (virtio_gpu_is_shmem(bo) && use_dma_api)
 		dma_sync_sgtable_for_device(vgdev->vdev->dev.parent,
 					    shmem->pages, DMA_TO_DEVICE);
 
-- 
2.35.1


  parent reply	other threads:[~2022-04-11 22:00 UTC|newest]

Thread overview: 41+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-04-11 21:59 [PATCH v3 00/15] Add generic memory shrinker to VirtIO-GPU and Panfrost DRM drivers Dmitry Osipenko
2022-04-11 21:59 ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 01/15] drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` Dmitry Osipenko [this message]
2022-04-11 21:59   ` [PATCH v3 02/15] drm/virtio: Check whether transferred 2D BO is shmem Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 03/15] drm/virtio: Unlock GEM reservations on virtio_gpu_object_shmem_init() error Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 04/15] drm/virtio: Unlock reservations on dma_resv_reserve_fences() error Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 05/15] drm/virtio: Use appropriate atomic state in virtio_gpu_plane_cleanup_fb() Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 06/15] drm/virtio: Simplify error handling of virtio_gpu_object_create() Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 07/15] drm/virtio: Improve DMA API usage for shmem BOs Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 08/15] drm/virtio: Use dev_is_pci() Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 09/15] drm/shmem-helper: Correct doc-comment of drm_gem_shmem_get_sg_table() Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 10/15] drm/shmem-helper: Take reservation lock instead of drm_gem_shmem locks Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 11/15] drm/shmem-helper: Add generic memory shrinker Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-12  3:35   ` kernel test robot
2022-04-12  3:35     ` kernel test robot
2022-04-12  3:35     ` kernel test robot
2022-04-12  7:25   ` kernel test robot
2022-04-12  7:25     ` kernel test robot
2022-04-12  7:25     ` kernel test robot
2022-04-12  7:25   ` kernel test robot
2022-04-12  7:25     ` kernel test robot
2022-04-12  7:25     ` kernel test robot
2022-04-11 21:59 ` [PATCH v3 12/15] drm/virtio: Support memory shrinking Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 13/15] drm/panfrost: Switch to generic memory shrinker Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 14/15] drm/shmem-helper: Make drm_gem_shmem_get_pages() private Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko
2022-04-11 21:59 ` [PATCH v3 15/15] drm/shmem-helper: Remove drm_gem_shmem_purge() Dmitry Osipenko
2022-04-11 21:59   ` Dmitry Osipenko

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220411215937.281655-3-dmitry.osipenko@collabora.com \
    --to=dmitry.osipenko@collabora.com \
    --cc=airlied@linux.ie \
    --cc=alyssa.rosenzweig@collabora.com \
    --cc=daniel.almeida@collabora.com \
    --cc=daniel@ffwll.ch \
    --cc=digetx@gmail.com \
    --cc=dri-devel@lists.freedesktop.org \
    --cc=gert.wollny@collabora.com \
    --cc=gurchetansingh@chromium.org \
    --cc=gustavo.padovan@collabora.com \
    --cc=kraxel@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=maarten.lankhorst@linux.intel.com \
    --cc=mripard@kernel.org \
    --cc=olvaffe@gmail.com \
    --cc=robdclark@gmail.com \
    --cc=robh@kernel.org \
    --cc=steven.price@arm.com \
    --cc=tomeu.vizoso@collabora.com \
    --cc=tzimmermann@suse.de \
    --cc=virtualization@lists.linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.